CVE-2026-71557-poc

CVE-2026-71557: go-git 참조 이름 경로 탐색 PoC English version 개요 이 리포지토리는 go-git 공개 보안 권고 GHSA-qgq7-7hm3-q39j 에 기반한 CVE-2026-71557 의 안전한 로컬 PoC입니다. 수정 전의 storage/filesystem은 loose reference 이름을 충분히 검증하지 않고 .git/ 경로로 사용했습니다. 그 때문에 refs/heads/../../config 같은 참조 이름을 전달하면 ..이 정규화되어 본래 reference storage 외부에 ...

gogs

gogs 여기에서는 SEED Ubuntu 16.04 VM에 실습 환경을 구축합니다. SQL 인젝션 취약점을 공격하기 전에 먼저 VM에 Go Git ServiceGOGS를 설치해야 합니다. VM을 설정하는 단계는 다음과 같습니다. 1단계: 데이터베이스 설치 시스템에 로그인한 후, 라이브러리와 저장소가 업데이트되었는지 확인하기 위해 다음 명령을 실행해야 합니다. $ sudo apt-get -y update 백엔드에서 MySQL 서버를 사용하므로 VM에 MySQL 서버를 설치해야 합니다. 다음 명령으로 설치할 수 있습니다: $ su...

CVE-2026-44881_exploit

CVE-2026-44881 — Portainer Git シンボリックリンク → 任意のホストファイル読み取り CVE-2026-44881 のシングルスクリプトエクスプロイト。Portainer のスタックデプロイフローにおける Git シンボリックリンク注入により、スタック作成権限を持つ低権限の認証ユーザーが Portainer プロセスからアクセス可能な任意のファイルを読み取ることができます。 アドバイザリ: GHSA-rpgq-m5fp-32wr 影響を受けるバージョン: Portainer CE 2.33.0 – 2.33.7、2.39.0 – 2.39.1、2.40.x...

ROOT-APP-GOBINARY-CVE-2026-45570 CVE-2026-45570 in github.com/go-git/go-git/v5 - Patched by Root

Root has patched CVE-2026-45570 in the github.com/go-git/go-git/v5 package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-45022 CVE-2026-45022 in github.com/go-git/go-git/v5 - Patched by Root

Root has patched CVE-2026-45022 in the github.com/go-git/go-git/v5 package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-71556 CVE-2026-71556 in github.com/go-git/go-git/v5 - Patched by Root

Root has patched CVE-2026-71556 in the github.com/go-git/go-git/v5 package for Root:Go. Multiple fixed versions available...

ROS-20261001-73-0020

The vulnerability in Go-Git relates to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

Amazon Linux 2 : amazon-ssm-agent (ALAS-2026-3963)

The version of amazon-ssm-agent installed on the remote host is prior to 3.3.5226.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3963 advisory. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a...

Rocky Linux 8 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux Multiple Vulnerabilities (crlsa-2025_0401)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20250401 advisory. go-git: argument injection via the URL field CVE-2025-21613 go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies...

CLEANSTART-2026-MF55431 go-git is an extensible git implementation library written in pure Go

CVE-2026-71557 affects multiple packages. go-git is an extensible git implementation library written in pure Go. See references for individual vulnerability details...

CLEANSTART-2026-JT96055 go-git is an extensible git implementation library written in pure Go

CVE-2026-71556 affects multiple packages. go-git is an extensible git implementation library written in pure Go. See references for individual vulnerability details...

Amazon Linux 2 : amazon-ssm-agent (ALAS-2026-3933)

The version of amazon-ssm-agent installed on the remote host is prior to 3.3.5226.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3933 advisory. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a...

Security update for amazon-ssm-agent (important)

openSUSE security update: security update for amazon-ssm-agent ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21884-1 Rating: important References: bsc1276981 bsc1276994 bsc1278681 Cross-References: CVE-2026-56854 CVE-2026-56855 CVE-2026-71556...

Security update for amazon-ssm-agent

This update for amazon-ssm-agent fixes the following issues: CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families bsc1278681 CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel bsc1278681 CVE-2026-78662:...

CVE-2026-71557

A flaw was found in go-git, an extensible Git implementation library. Maliciously crafted reference names, which can contain directory-traversal sequences, are not properly sanitized. This vulnerability allows an attacker to write files outside of the intended reference storage directory,...

SUSE SLES15 Security Update : amazon-ssm-agent (SUSE-SU-2026:4082-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4082-1 advisory. - CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution bsc1276981. - CVE-2026-71557:...

github.com/go-git/go-git: github.com/go-git/go-git/v5: go-git: Unauthorized file modification via directory traversal in reference names

A flaw was found in go-git, an extensible Git implementation library. Maliciously crafted reference names, which can contain directory-traversal sequences, are not properly sanitized. This vulnerability allows an attacker to write files outside of the intended reference storage directory,...

github.com/go-git/go-git: github.com/go-git/go-git/v5: go-git: Unauthorized file modification via directory traversal in reference names

A flaw was found in go-git, an extensible Git implementation library. Maliciously crafted reference names, which can contain directory-traversal sequences, are not properly sanitized. This vulnerability allows an attacker to write files outside of the intended reference storage directory,...

CLEANSTART-2026-NK57336 go-git is an extensible git implementation library written in pure Go

Multiple security vulnerabilities affect the grafana-alloy package. go-git is an extensible git implementation library written in pure Go. See references for individual vulnerability details...

PT-2026-99827

Multiple security vulnerabilities affect the grafana-alloy package. go-git is an extensible git implementation library written in pure Go. See references for individual vulnerability details...